Case 1:05-mj-00494-JMF Document 1-2 Filed 09/12/2005 Page 1 of 22 

AFFIDAVIT IN SUPPORT OF A SEARCH WARRANT 

I, David Condo, ("your Affiant"), being duly sworn, depose and state as follows: 

1 . I am a Special Agent with the Federal Bureau of Investigation ("FBI") and have been 
employed as a Special Agent of the FBI since March 28, 1999. I have investigated federal criminal 
violations related to crimes against children and cybercrime. I am currently assigned to the FBI's 
Innocent Images National Initiative, which investigates matters involving the online sexual 
exploitation of children including violations pertaining to the illegal production, distribution, receipt 
and possession of child pornography, in violation of 18 U.S.C. §§ 2251, 2252 and 2252A. I have 
received formal training and have participated in numerous search warrants in these matters. As a 
federal agent, I am authorized to investigate violations of laws of the United States and am a law 
enforcement officer with the authority to execute warrants issued under the authority of the United 
States. 

2. This affidavit is made in support of an application for a warrant to search the premises of 
Everyone's Internet, 390 Benmar, Suite 200, Houston, Texas 77060 ("subject premises"), for stored 
wire and electronic communications and transactional records that may be evidence of violations of 
Title 18, United States Code, Sections 2252 and 2252A, including the possession, transportation and 
distribution of child pornography. 

3. The purpose of this application is to seize evidence of violations of 18 U.S.C. §§ 
2252(a)(4)(B) and 2252A (a)(5)(B), which make it a crime to possess child pornography, and 
violations of 18 U.S.C. §§ 2252(a)(2) and 2252(A)(a)(2), which make it a crime to receive or 
distribute childpomography in interstate commerce and §§ 2252(a)(1) and2252A(a)(l), whichmake 
it a crime to transport or ship child pornography in interstate commerce. 
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4. The facts and information contained in this affidavit are based on my own investigation 
which inciudes information conveyed to me by other iaw enforcement officiais, other cooperating 
individuais, my personai experience with reiated offenses, and my personai Icnowiedge and 
observations during the course of this investigation. 

5. Because this Affidavit is being submitted for the iimited purpose of securing a search 
warrant, I have not inciuded each and every fact known to me concerning this investigation. I have 
set forth oniy the facts that I beiieve are necessary to estabiish probabie cause that evidence of 
vioiation of 1 8 U.S.C. §§ 2252 and 2252A are iocated at the subject premises, in the form of stored 
wire and eiectronic communications and transactionai records. 

6. As a resuit of the instant investigation described more fiiiiy beiow, there is probabie cause 
to beiieve that evidence and fruits of vioiations of federal law, inciuding 18 U.S.C. §§ 2252 and 
2252A, is currently present at the subject premises. 

APPLICABLE LAW 

7. Title 18, United States Code, Sections 2252(a)(1) and 2252A(a)(l), make it a federal 
crime for anyperson to ship or transport any visual depiction of a minor engaging in sexually explicit 
conduct or child pornography (hereinafter referred to jointly as "child pornography") in interstate or 
foreign commerce. 

8. Title 18, United States Code, Sections 2252(a)(2) and 2252A(a)(2), make it a federal 
crime for any person to knowingly receive or distribute child pornography that has traveled in 
interstate or foreign commerce. 

9. Title 18, United States Code, Sections 2252(a)(4)(B) and 2252A(a)(5)(B) make it a federal 
crime for any person to knowingly possess any material that contains an image of child pornography 
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that has been mailed, or shipped or transported in interstate of foreign commerce by any means, 
including by computer, or that was produced using materials that have been mailed, or shipped or 
transported in interstate or foreign commerce by any means, including by computer. 

APPLICABLE DEFINITIONS 

10. The term "minor," as used herein, is defined pursuant to Title 18, United States Code, 
Section 2256(1), as "any person under the age of eighteen years." 

11. The term "sexually explicit conduct," as used herein, is defined pursuant to Title 18, 
United States Code, Section 2256(2) as "actual or simulated (A) sexual intercourse, including 
genital-genital, oral-genital, anal-genital, or oral-anal, whether between persons of the same or 
opposite sex; (B) bestiality; (C) masturbation; (D) sadistic or masochistic abuse; or (E) lascivious 
exhibition of the genitals or pubic area of any person." Factors to be considered in determining if 
an image constitutes "lascivious exhibition" include 1) whether the focal point of the depiction is 
the child's genitalia or pubic area; 2) whether the setting is sexually suggestive, i.e., in a place or 
pose generally associated with sexual activity; 3) whether the child is depicted in an unnatural pose 
or in inappropriate attire, considering the age of the child; 4) whether the child is full or partially 
clothes or nude; 5) whether the depiction suggest sexual coyness or a willingness to engage in sexual 
activity; 6) whether the depiction is intended or designed to elicit a sexual response in the viewer. 
United States v. Dost . 636 F.Supp. 828 (N.D. Cal. 1986). See also : United States v. Wiegand . 812 
F.2d 1239 (9* Cir. 1987); and United States v. Kemmerling . 285 F.3d 644 (8* Cir. 2002); 

12. The term "visual depiction," as here herein, is defined pursuant to Title 1 8, United States 
Code, Section 2256(5) as including "undeveloped film and videotape, and data stored on computer 
disk or by electronic means which is capable of conversion into a visual image. 

-3- 



Case 1 :05-mj-00494-JMF Document 1 -2 Filed 09/1 2/2005 Page 4 of 22 

13. The term "child pornography," as used herein, is defined pursuant to Title 18, United 
States Code, Section 2256(8) as "any visual depiction, including any photography, film, video, 
picture or computer or computer generated image or picture, whether made or produced by 
electronic, mechanical, or other means of sexually explicit conduct, where (A) the production of such 
visual depiction involves the use of a minor engaging in sexually explicit conduct; (B) such visual 
depiction is a digital image, computer image, or computer-generated image that is, or is 
indistinguishable from, that of a minor engaging in sexually explicit conduct; or (C) such visual 
depiction has been created, adapted, or modified to appear that an indentifiable minor is engaging 
in sexually explicit conduct. 

14. The term "child erotica", as used herein, means "any material, relating to children, that 
serves a sexual purpose for a given individual." See Kenneth V. Tanning, Child Molesters: A 
Behavioral Analysis (2001) at 65. Some of the more common types of child erotica include 
photographs that are not sexually explicit, drawings, sketches, fantasy writings, diaries, and sexual 
aids. Federal courts have recognized the evidentiary value of child erotica and its admissibility in 
child pornography cases. United States v. Cross , 928 F.2d 1030 (11* Cir. 1991) (testimony about 
pedophiles deriving sexual satisfaction from and collecting non-sexual photographs of children 
admissible to show intent and explain actions of defendant). 

15. The term "computer" as used herein is defined pursuant to 18 U.S.C. §1030(e)(l), as 
including an electronic, magnetic, optical, electrochemical, or other high speed data processing 
device performing logical, arithmetic, or storage fiinctions, and includes any data storage facility or 
communications facility directly related to or operating in conjunction with such device. 
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THE INTERNET AND DEFINITIONS OF TECHNICAL TERMS 
PERTAINING TO COMPUTERS 

1 6. As part of my training and experience as well as discussions with other law enforcement 
officers with experience in cases involving computer use, I have become familiar with the Liternet, 
which is a global network of computers and other electronic devices that communicate with each 
other using various means, including standard telephone lines, high-speed telecommunications links 
(e.g., copper and fiber optic cable), and wireless transmissions including satellite. Due to the 
structure of the Internet, connections between computers on the Liternet routinely cross state and 
international borders, even when the computers communicating with each other are in the same state. 
Individuals and entities use the Internet to gain access to a wide variety of information; to send 
information to, and receive information from, other individuals; to conduct commercial transactions; 
and to communicate via electronic mail ("e-mail"). An individual who wants to use Internet e-mail 
must first obtain an account with a computer that is linked to the Internet - for example, through a 
university, an employer, or a commercial service - which is called and "Internet Service Provider" 
or "ISP" (see definition of "Internet Service Provider" below). Once the individual has accessed the 
Internet, that individual can do a variety of things including visiting websites (see definition of 
"website" below), and making purchases from them, including credit card transactions. 

17. Set forth below are some definitions of technical terms used within this Affidavit, 
pertaining to the Intemet and computers more generally: 

a. Client/Server Computing: Computers on the Intemet are identified by the type of 

function they perform. A computer that provides resources for other computers on 
the Intemet is known as a server. Servers are known by the types of services they 
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provide, that is how they are configured. For exampie, a web server is a machine that 
is configured to provide web pages to other computers requesting them. An e-maii 
server is a computer that is configured to send and receive electronic mail from other 
computers on the Internet. 

b. Domain Name: Domain names are typically strings of alphanumeric characters, 
with each level delimited by a period that are associated with a unique Intemet 
Protocol ("IP") addresses (defined below). For example, a domain name of 
"www.usdoj.gov" refers to the IP address of 149. 101. 1. 32. Each level, read 
backwards - from right to left - further identifies parts of an organization. Examples 
of first level or top-level domain are typically .com for commercial organizations, 
.gov for the United States govemment, .org for organizations, and .edu for 
educational organizations. Second level names will flirther identify the 
organizations, for example usdoj.gov further identifies the United States 
governmental agency to be the Department of Justice. Additional levels may exist 
as needed until each machine is uniquely identified. For example, www.usdoi.gov 
identifies the world wide web server located at the United States Department of 
Justice, which is part of the United States govemment. 

c. Internet Service Providers (ISPs) and the Storage of ISP Records: Intemet 
Service Providers ("ISPs") are commercial organizations that are in business to 
provide individuals and businesses access to the Intemet. ISPs may provide a range 
of fiinctions for their customers including access to the Internet, web hosting, e-mail, 
remote storage, and co-location of computers and other communication equipment. 
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ISPs maintain records ("ISP records") pertaining to their subscribers (regardless of 
whether those subscriptions are individuals or entities). These records may include 
account application information, subscriber and billing information, account access 
information (often times in the form of log files), e-mail communications, 
information concerning content uploaded and/or stored on or via the ISP's servers, 
and other information, which may be stored both in computer data format and in 
written or printed record format. ISPs reserve and/or maintain computer disk storage 
space on their computer system for their subscribers' use. This service by ISPs allow 
for both temporary and long-term storage of electronic communications and many 
other types of electronic data and files. Typically, e-mail that has not been opened 
by an ISP customer is stored temporarily by an ISP incident to the transmission of 
that e-mail to the intended recipient, usually within an area known as the home 
directory. Such temporary, incidental storage is defined by statute as "electronic 
storage," see 18 U.S.C. §2510(17), and the provider of such a service is an 
"electronic communications service." An "electronic communications service," as 
defined by statute, is "any service which provides to users thereof the ability to send 
or receive wire of electronic communications. 18 U.S.C. §2510(15). A service 
provider that is available to the public and provides storage facilities after an 
electronic communication has been transmitted and opened by a recipient, or 
provides other long term storage services to the public for electronic data and files, 
is defined by statute as providing a "remote computer service." 18 U.S.C. §271 1(2). 
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d. Internet Protocol Address: Every computer or device on the Internet is referenced 

by a unique IP address the same way every telephone has a unique telephone number. 
An IP address is a series of four numbers separated by a period, and each number is 
a whole number between and 254. An example ofanIP address is 192.168.10.102. 
Each time an individual accesses the Internet, the computer from which that 
individual initiates access is assigned an IP address. A central authority provides 
each ISP a limited block of IP addresses for use by that ISP's customers or 
subscribers. ISP's can employ dynamic IP addressing, that is they allocate any 
unused IP address at the time of initiation of an Internet session each time a customer 
or subscriber accesses the Internet. A dynamic ff address is reserved by an ISP to be 
shared among a group of computers over a period of time. The ISP logs the date, 
time and duration of the Internet session for each IP address and can identify the user 
of that IP address for such a session from these records. Typically, users who 
sporadically access the Intemet via a dial-up modem will be assigned an ff address 
from a pool of IP addresses for the duration of each dial-up session. Once the session 
ends, the IP address is available for the next dial-up customer. On the other hand, 
some ISPs employ static IP addressing, that is a customer or subscriber's computer 
is assigned one IP address that is used to identify each and every Intemet session 
initiated through that computer. In other words, a static IP address is an IP address 
that does not change over a period of time and is typically assigned to a specific 
computer. 
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e. "Who is" Lookup: A "whois" lookup is an Internet based tool that allows users the 
ability to find the corresponding IP address and web hosting company for a particular 
domain name. 

f. Log file: Log files are records automatically produced by computer programs to 
document electronic events that occur on computers. Computer programs can record 
a wide range of events including remote access, file transfers, logon/logoff times, and 
system errors. Logs are often named based on the types of information they contain. 
For example, web logs contain specific information about when a website was 
accessed by remote computers; access logs list specific information about when a 
computer was accessed from a remote location; and file transfer logs list detailed 
information concerning files that are remotely transferred. 

g. Website: A website consists of textual pages of information and associated graphic 
images. The textual information is stored in a specific format known as Hyper-Text 
Mark-Up language (HTML) and is transmitted from the web servers to various 
clients via the Hyper-Text Transport Protocol (HTTP). 

h. Website Hosting: Website hosting provides the equipment and services required to 
host and maintain files for one or more websites and to provide rapid Internet 
connections to those websites. Hosting can be "shared," which means that multiple 
websites of unrelated companies are on the same server in order to reduce associated 
costs. When a client develops a website, the client needs a server and perhaps a web 
hosting company to host it. "Dedicated hosting" means that the web hosting 
company provides all of the equipment and assumes all of the responsibility for 
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technical support and maintenance of a website. "Co-location" means a server is 
located at a dedicated hosting facility designed with special resources, such as a 
secure cage, regulated power, a dedicated Internet connection, online security and 
online technical support. Co-location facilities offer customers a secure place to 
physically house their hardware and equipment. 

COMPUTERS AND CHILD PORNOGRAPHY 
18. Based upon my knowledge, training, and experience and the experience and training of 
other law enforcement officers with whom I have had discussions, computers and computer 
technology have revolutionized the way in which child pornography is produced, distributed and 
utilized. Prior to the advent of computers and the Internet, child pornography was produced using 
cameras and film, resulting in either still photographs or movies. The photographs required 
darkroom facilities and a significant amount of skill in order to develop and reproduce the images. 
As a result, there were definable costs involved with the production of pornographic images. To 
distribute these images on any scale also required significant resources. The photographs themselves 
were somewhat bulky and required secure storage to prevent their exposure to the public. The 
distribution of these wares was accomplished through a combination of personal contacts, mailings, 
and telephone calls, and compensation for these wares would follow the same paths. More recently, 
through the use of computers and the Internet, distributors of child pornography have used 
membership based/subscription based websites to conduct business. With the advent of the Internet, 
child pornographers can produce, maintain, and share large collections of child pornography around 
the world quickly and at minimal cost. 
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19. In addition, based upon my own knowledge, training, and experience in child 
exploitation investigations, and the experience and training of other law enforcement officers with 
whom I have had discussions, the development of computers has revolutionized the way in which 
child pornography collectors interact with and sexually exploit children. For instance, the Internet 
allows users, while still maintaining relative anonymity, to easily locate (i) other individuals with 
similar interests in child pornography; (ii) potential victims and (iii) websites that offer images of 
child pornography. Child pornography collectors can use standard Internet connections, such as 
those provided by businesses, universities and government agencies, to communicate with each other 
and to distribute child pornography. These communication links allow contacts around the world 
as easily as calling next door. Additionally, these communications can be quick, relatively secure, 
and as anonymous as desired. All of these advantages, which promote anonymity for both the 
distributor and recipient, are well known and are the foundation of transactions between child 
pornography collectors over the Internet. 

THE INVESTIGATION 

20. In January 2004, the National Criminal Investigation Service ofNorway, also known as 
KRIPOS, launched a web-based hotline (www.tips.kripos.no) relating to, among other things, child 
pornography on the Internet. They titled this initiative "Operation Rainbow" and began to receive 
information concerning the commercial online distribution of child pornography. 

21. In February 2004, KRIPOS reviewed several hotline complaints and noticed that a 
number of the website domain names in the complaints were being registered by the same 
individuals. Norwegian investigators found numerous similarities between many of these web sites, 
including the site design, the graphical solutions chosen, the preview pages, and the method of 
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payment. These similarities, as well as related data from the domain names, registration information, 
the placement in IP ranges, and the use of particular domain name servers, led KRIPOS to believe 
the same individuals were operating a large number of these web sites. 

22. On June 17, 2004, KRIPOS purchased access to the following websites using an 
undercover credit card: 

- "Newboys", advertised at http://newboys.boys-art.org, payment service of "Orangebill" at 
http://members.boyavs.com 

- "Preteen pussy", advertised at http://pt.smallest-pussy.com, payment service of "Obebill" 
at http://pb.adv-host.net 

- "Perfect cuties", advertised at http://www.perfect-cuties.com, payment service of 
"Orangebill" using http://onl7-17.com 

23. All of the Members Areas to these sites contained pictures of unclothed minors in 
various poses including child pornography and child erotica. According to Europay (Mastercard) 
Norway, the money from all of the above-described undercover transactions have gone to the 
company GSBILL (www.gsbill.com)' through the Dutch company InterPay. 

24. GSBILL is a company that submits the credit card information of website customers to 
a financial institution for processing of the website membership charges. To process these charges, 
GSBILL has established a "merchant account" with InterPay. GSBILL receives money from the 
website membership charges into a bank account that is specified in their merchant agreement. 

25. KRIPOS obtained GSBill account information from InterPay. These records showed the 



' GSBILL also goes by the identifiers GSBill, GSBill.com GSBILL.COM, gsbill, 
gsbill.com. 
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money from the KRIPOS undercover purchases went into a bank account held by GSBill in 
Ijmuiden, The Netherlands. The account records identified the owner of GSBill as Ruslan Dubouski. 
The company representative is a Dutch citizen named Franciscus Antonius van der Poll. Ruslan 
Dubouski has been identified by the Belarus Ministry of Internal Affairs (MVD) as a citizen of the 
country of Belarus. 

26. On January 10, 2005, Special Agent David Condo, Lmocent Images International Task 
Force, made an undercover membership purchase into the website www . lo litanymphets .com. SA 
Condo paid a total of $47.90 on his undercover credit card for one month membership to this site. 
The company that provided the online form for purchase into this website advertised its name as 
"Orangebill". On January 18, 2005, Special Agent Condo accessed the Member's Area of this site 
and downloaded multiple images of unclothed minor girls in a variety of poses. These images 
included child pornography and child erotica. One of the child pomography images depicts an 
unclothed girl approximately 12-13 years of age standing with her arms around another unclothed 
girl approximately 12-13 years of age with both of their vaginal areas displayed to the camera. 

27. When Special Agent Condo received his undercover credit card statement, it reflected 
a charge of $47.90 with a transaction date of January 11, 2005 and listed "GS Bill GSBILL COM" 
under the heading of "Merchant Name or Transaction Description". 

28. On January 31 , 2005, Special Agent Condo, while operating in an undercover capacity, 
accessed the website gsbill.com and filled out an online form requesting clarification of the $47.90 
charge. Special Agent Condo received a reply email on February 1 , 2005 from support@gsbill.com 
which stated that GSBILL would refund the charge. SA Condo had never requested a refund or 
claimed that the charge was fraudulent. 
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29. On February 22, 2005, SA David Condo accessed a website using domain name 
www.geocities.com/felicia_mullins_45/wliicli was titled "Underage Material"and which included 
the advertisement "HOT FREE PEDO GALLERY. ..Welcome to the forbidden realm where dreams 
come to life!". The main page of the site features an image of a topless girl approximately 10-12 
years of age in the arms of an adult male as well as a picture gallery of close-up images of females 
with their breast and vaginal areas exposed. 

30. The website offered visitors the opportunity to purchase a membership to the site. In 
addition to the images as described in paragraph 29, the main page of the website provided a link 
labeled "Purchase Now." Special Agent Condo activated the "purchase now" link which directed 
him to a web page enabling him to complete a membership purchase to the website. 

31. Special Agent Condo, using an undercover credit card, purchased a one month 
membership for $54.95 plus a processing fee of $8.95 for a total cost of $63.90. After successfLiUy 
completing the membership purchase. Special Agent Condo was provided with a usemame and 
password to the Member's Area of the website which was located at 
http://darkmem.littleage.com/index.html. After submitting his username and password. Special 
Agent Condo gained access to the members only area and viewed and downloaded multiple images 
of minor females that were in various galleries on the website. The website provided both child 
erotica and child pornography. One of the child pornography images depicted an unclothed girl 
approximately 12-13 years of age lying on her back with her legs spread apart exposing her vaginal 
area. Another child pornography image depicts an unclothed girl approximately 12-13 years of age 
standing on one leg next to a fireplace with her other leg propped up on the fireplace exposing her 
vaginal area. Another child pornography image depicts another unclothed female, approximately 12- 
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13 years of age with her hand cupping the breast of an unclothed adult female. 

32. Special Agent Condo performed a "whois" lookup on the domain name littleage.com and 

found that the content on the website was located at IP address 207.218.219.109 which is assigned 
to an Internet Service Provider called Everyone's Internet located at 390 Benmar, Suite 200, Houston, 
Texas 77060. Web page http://darkmem.littleage.com/index.html is a part of the website 
littleage.com. 

33 . In response to an Administrative Subpoena, Everyone's Internet provided information that 
the IP address 207.218.219.109 is a static IP address that was assigned to one of their dedicated web 
hosting customers. The account information for their customer is as follows: 

Name: Viktar Akalinski 
Company: obebill.com 
Address: Elizabetes Str., 23, Riga, Latvia 

34. On May 27, 2005, Viktar Akalinski was interviewed in Minsk, Belarus by a law 
enforcement officer of the Republic of Belarus, Ministry of Internal Affairs (MVD), Hi-Tech Crime 
Unit. Akalinski stated that he has never had any bank accounts, business concerns, servers, or 
Internet sites registered in his name, and he has not given consent for anybody to use his name in that 
manner. Akalinski stated that he lives alone, is unemployed, and does not have a computer at his 
house. He also reports he lost his passport approximately 3 years ago. 

35. On May 27, 2005, Chris Newcomb, Abuse Team Leader at Everyone's Internet, 390 
Benmar, Suite 200, Houston, Texas 77060, provided information that obebill.com^ account had 
recently been using a different credit card every month to pay its account fees to Everyone's Internet. 



^ Obebill is also known as Orangebill. 
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Because of this payment irregularity, Everyone's Internet terminated the account on May 11, 2005 
based on their suspicion of fraud. As part of their standard procedure when an account is terminated 
for suspected criminal activity. Everyone's Internet made an electronic backup copy of the content on 
the servers that were rented by obebill.com. Special Agent Condo advised Newcomb to preserve this 
content in anticipation of the required legal process being served upon Everyone's Internet. 

36. On June 10, 2005, Special Agent David Condo obtained a search warrant and executed 
it on the offices of Everyone's Internet, 390 Benmar, Suite 200, Houston, Texas 77060 for all 
information and preserved server content for the obebill.com server. The information obtained 
pursuant to the search warrant revealed multiple databases of customers, webmasters, and advertisers 
related to memberships to a variety of websites, including the littleage.com site which contains child 
pomography. The server also contained a table which listed merchants who processed the credit card 
payments for the websites listed. This table contained only two entries, one of which was GSBill at 
gsbill.com. The second entry was incomplete. 

37. On July 27, 2005, Special Agent David Condo, while operating in an undercover capacity, 
visited the web site www.gsbill.com and found that this website was being hosted at the IP address 
of 66.98.198.53. This IP address is also owned and assigned by Everyone's Internet. 

38. The investigation has revealed that Everyone's Internet provides web hosting services to 
GSBILL using servers located at 390 Benmar, Suite 200, Houston, TX 77060. 

39. On July 27, 2005, Special Agent David Condo, contacted Chris Newcomb, Abuse Team 
Leader at the web hosting company Everyone's Internet in Houston, Texas and requested the contents 
ofgsbill.com web server be preserved in anticipation of a search warrant. 
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EVERYONE'S INTERNET 

40. Your affiant has personally reviewed the Everyone's Internet website and spoken with 
Everyone's Internet representatives in Texas. Everyone's Internet, an Internet Service Provider, is 
an electronic communication service provider. Everyone's Internet provides subscribers with access 
to many Internet services and features. Everyone's Internet provides an electronic mail (email) 
service, which allows Everyone's Internet members to communicate with other members, and 
computer users who may have different electronic mail systems. Everyone's Internet members are 
able to access the Everyone's Internet servers through the use of a computer and computer modem 
or other connection device. Through this computer access. Everyone's Internet members are able to 
communicate through electronic mail (e-mail) systems or other software devices. Through the use 
of e-mail, the Everyone's Internet member is able to send messages, which can include an attached 
file, which may contain text messages, graphic image files or other file types. Those files are sent in 
a computer format. 

41. Subscribers to Everyone's Internet use email addresses during communications with 
others. The email addresses may or may not identify the real name of the person using a particular 
email address or computer. Everyone's Internet allows customers to access email from anywhere. 

42. Everyone's Internet also provides web hosting including dedicated web hosting and 
claims to own one of the largest dedicated hosting firms in the United States. 

LEGAL AUTHORIZATION 

43. The legal authority for this search warrant application is derived from 18 U.S.C. §§ 
2701-11, entitled "stored wire and electronic communications and transactional records access." 
Section 2703(a) provides in relevant part: 
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A governmental entity may require the disclosure by a provider of electronic 
communication service of the contents of a wire or electronic communication, that is 
in electronic storage in an electronic system for one hundred and eighty days or less, 
only pursuant to a warrant issued using the procedures described in the Federal Rules 
of Criminal Procedure by a court with jurisdiction over the offense under 
investigation or equivalent State warrant. A governmental entity may require the 
disclosure by a provider of electronic communications services of the contents of a 
wire or electronic communication that has been in electronic storage in an electronic 
communications system for more than one hundred and eighty days by the means 
available under subsection (b) of this section. 
18 U.S.C. § 2703(a), as amended with the language in italics, by the Uniting and Strengthening 
America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism (USA Patriot 
Act) of 2000, 115 Stat. 272, 291, Pub.L. 107-173, Sec. 220 ("Nationwide Service of Search Warrants 
for Electronic Evidence"). 

Section 2703 (b) provides in relevant part: 

( 1 ) A governmental entity may require a provider of remote computing service to 
disclose the contents of any wire or electronic communication to which this paragraph 
is made applicable by paragraph (2) of this subsection- 

(A) Without required notice to the subscriber or customer, if the 
governmental entity obtains a warrant issued using the procedures described in the 
Federal Rules of Criminal Procedure by a court with jurisdiction over the offense 
under investigation or equivalent State warrant. 
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* * * 



(2) Paragraph (1) is applicable with respect to any wire or electronic 
communication that is held or maintained on that service- 



* =|5 * 



(A) on behalf of, and received by means of electronic transmission from 
(or created by means of computer processing of communications received by means 
of electronic transmission from), a subscriber or customer of such remote computing 
service, and (B) solely for the purpose of providing storage or computer processing 
services to such subscriber or customer, if the provider is not authorized to access the 
contents of any such communications for purposes of providing any services other 
than storage or computer processing. 
44. The government may also obtain records relating to e-mail commiuiications, such as 

subscriber identifying information, by way of the search warrant. 18 U.S.C. § 2703(c)(1)(A). No 

notice to the subscriber is required. 18 U.S.C. § 2703(c)(3). 
Section 271 1 provides in relevant part: 

(2) the term 'remote computing service' means the provision to the public of 
computer storage or processing services by means of an electronic communication 
system; and 

(3) the term 'court of competent jurisdiction ' has the meaning assigned by section 
3127, and includes any Federal court within that definition, without geographic 
limitation. 

18 U.S.C. § 271 1, as amended by the USA Patriot Act with the text in italics to authorize 
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nationwide service of search warrants for electronic evidence. 
Section 2510 provides in relevant part: 

(8) "contents", when used with respect to any wire, oral, or electronic 
communication, includes any information concerning the substance, purport, or 

meaning of that communication; 

* * * 

(14) "electronic communications system" means any wire, radio, electromagnetic, 
photo optical or photo electronic facilities for the transmission of wire or electronic 
communications, and any computer facilities or related electronic equipment for the 
electronic storage of such communications; 

(15) "electronic communication service" means any service, which provides to 

users thereof the ability to send or receive wire or electronics communications; 

* * * 

(17) "electronic storage" means- 

(A) any temporary, intermediate storage of a wire or electronic 
communication incidental to the electronic transmission thereof; and (B) any storage 
of such communication by an electronic communication service for purposes of 
backup protection of such communication. 

45. Pursuant to Title 18, United States Code, Section 3238, when the residence(s) or the 
offender(s) are unknown, jurisdiction is appropriate in the District of Columbia. 
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CONCLUSION 

46. Based upon the above information, I have probable cause to believe that violations of 
Title 18, United States Code, Sections 2252, 2252A, etseq., have been committed and that the items 
described in Attachment A are evidence, fruits, and instrumentalities of those violations and are 
located at the subject premises. Everyone's hitemet, 390 Benmar, Suite 200, Houston, Texas 77060, 
in the form of stored wire and electronic communications and transactional records. By this affidavit, 
I request that the Court issue a warrant authorizing a search of the subject premises and any computer 
or media found therein, and the seizure of the items described in Attachment A. 



David A. Condo 

Special Agent 

Federal Bureau of Investigation 



Sworn to and subscribed before me this day of September, 2005. 



United States Magistrate Judge 
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ATTACHMENT A 
DESCRIPTION OF ITEMS TO BE SEIZED 

1. All content of the gsbill.com servers at Everyone's Internet, 390 Benmar, Suite 200, 
Houston, Texas 77060, including any computer files that were or may have been used as a means to 
provide images of child pornography over the Internet, in violation of 1 8 U.S.C. § § 2252 and 2252A. 

2. All business records, in any form, which pertain to the gsbill.com account and its use 
of IP address 66.98.198.53, to include all email, ICQ communications, log filesofany and all activity, 
or other communications sent by or received by the account holders, directly or indirectly, whether 
saved or deleted, and any and all credit card numbers or other methods and identifiers used to pay for 
the account. 
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